Exam 70-345 topic 1 question 16 discussion

You have an Exchange Server 2016 organization. The organization contains accepted domains for contoso.com and litwareinc.com. The antimalware engine is enabled on Mailbox servers and uses the default policy. You do not create any custom malware rules.
You need to notify internal senders when a malware attachment is detected. The rule must apply only when the recipient domain is contoso.com.
Which two cmdlets should you use? Each correct answer presents part of the solution.